Skip to content

Provisioning

The SAP Direct connector supports provisioning, allowing you to create and manage accounts and entitlements in SAP Direct directly from SailPoint.

Prerequisite: Your system is configured for provisioning.

When SailPoint provisions new accounts to the source, it uses the attributes on the Create Account page as instructions or a template for what to include in the account. This page is also referred to as the provisioning policy.

When new access is granted on a source where a user does not already have an account, SailPoint automatically includes account creation in the provisioning. This applies whether provisioning is started from an access request or from an automated role or lifecycle state assignment.

For direct-connect sources, SailPoint automatically creates the account from this configuration. If the source is not configured as a direct-connect source, SailPoint creates and assigns a provisioning task to the source owner and includes the values for the source owner to use in manually creating the account.

Important

This section describes the default Create Account configuration. SailPoint recommends that you work with Services to define a provisioning configuration specific to your company's needs. Be sure to verify large changes to the provisioning policy before implementation. Failure to do so might cause provisioning to fail.

Provisioning Policy Attributes

The following generators create required information for a new SAP Direct account. You may need to edit the contents.

Some of the values needed to create a SAP Direct account require a generator which compiles the appropriate attribute value based on a variety of information.

Note

To add user-friendly definitions for entitlements on direct connect sources, refer to Managing Entitlements.

Account Attribute Generator Description
User name Create Unique Account ID This generator uses the value in the Pattern Used field to generate a unique user name for the new account.
password Create Password This generator creates an initial password for the new account that matches the password policy assigned to the associated SAP Direct source.
Last name Identity Attribute Last name of the user.

The following list contains the provisioning policy attributes for Create/Modify Account:

Note

The attributes marked with an asterisk (*) are required attributes.

Attribute Name Description
User Name* Name of the user to create
password Password for the user
Last Name* Last name of the user

Entitlement Validity Period

The user can be assigned a SAP Role with Start Date and an End Date. The ability to select or specify the same, while requesting an entitlement for an account, is available in SAP Direct by creating a custom Provisioning Plan.

Following is the Sample attribute request when assignment dates are in Date format:

[
  {
   "AttributeRequest": {
        "name": "Roles",
        "op": "Add",
        "value": "SAP_AUDITOR_SA",
        "attributes": {
            "assignment": true,
            "startDate": 1441195751000,
            "endDate": 1441449381000
            }
        }
  },
  {
  "AttributeRequest": {
        "name": "Roles",
        "op": "Set",
        "value": "SAP_AUDITOR_SA",
        "attributes": {
            "assignment": true,
            "startDate": 1441195751000,
            "endDate": 1441449381000
         }
    }
 }  
]

Following is the Sample attribute request when assignment dates are in String format:

[
  {
    "AttributeRequest": {
      "name": "Roles",
      "op": "Add",
      "value": "SAP_BC_DB_ADMIN",
      "Attributes": {
        "Map": {
          "assignment": "true",
          "startDate": "2014-1-1",
          "endDate": "2015-2-2"
        }
      }
    }
  },
  {
    "AttributeRequest": {
      "name": "Roles",
      "op": "Set",
      "value": "SAP_BC_DB_ADMIN",
      "Attributes": {
        "Map": {
          "assignment": "true",
          "startDate": "2014-1-1",
          "endDate": "2015-2-2"
        }
      }
    }
  }
]

Password Management

If Password Management is enabled for your organization, you can change the password for a user of the source. After enabling password management on the source, be aware of the following:

  • The password policy defined in SailPoint applies to accounts on this source.
  • If you change the password for an application connected to this source, the change will automatically be made to the source itself.

For more information on configuring password management, refer to Password Management Overview.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.